Abuse Elevation Control Mechanism `T1626`

Mobile Tactic: Privilege Escalation

Authoring guide

These 2 rules share fields, values, and exclusions.

Fields filtered most (4 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`AuditType`	1	`in` 1	`CONFIGURATION_CHANGE`, `POLICY_CHANGE`, `SECURITY_SETTING_CHANGE`
`EntityName`	1	`eq` 1	`role`
`EventType`	1	`eq` 1	`AUDIT`
`Message`	1	`eq` 1	`Create`

Top indicator values (7 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`AuditType`	`in`	`CONFIGURATION_CHANGE` kustoLookout - Critical Audit and Policy Changes (v2)	1
`AuditType`	`in`	`POLICY_CHANGE` kustoLookout - Critical Audit and Policy Changes (v2)	1
`AuditType`	`in`	`SECURITY_SETTING_CHANGE` kustoLookout - Critical Audit and Policy Changes (v2)	1
`AuditType`	`in`	`USER_MANAGEMENT` kustoLookout - Critical Audit and Policy Changes (v2)	1
`EntityName`	`eq`	`role` kustoDataverse - Suspicious security role modifications	1
`EventType`	`eq`	`AUDIT` kustoLookout - Critical Audit and Policy Changes (v2)	1
`Message`	`eq`	`Create` kustoDataverse - Suspicious security role modifications	1

Rules under this technique

These vendors publish rules tagged with this technique.

Kusto 2 rules